CVE-2018-1000069

FreePlane version 1.5.9 and earlier contains a XML External Entity (XXE) vulnerability in XML Parser in mindmap loader that can result in stealing data from victim's machine. This attack appears to require the victim to open a specially crafted mind map file. This vulnerability appears to have been fixed in 1.6+.

• CWE-611

• https://lists.debian.org/debian-lts-announce/2018/03/msg00019.htmlMailing List, Third Party Advisory
• https://www.debian.org/security/2018/dsa-4175Third Party Advisory
• https://www.freeplane.org/wiki/index.php/XML_External_Entity_vulnerability_in_map_parserVendor Advisory
• https://www.youtube.com/watch?v=7IXtiTNilAIExploit, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2018/03/msg00019.htmlMailing List, Third Party Advisory
• https://www.debian.org/security/2018/dsa-4175Third Party Advisory
• https://www.freeplane.org/wiki/index.php/XML_External_Entity_vulnerability_in_map_parserVendor Advisory
• https://www.youtube.com/watch?v=7IXtiTNilAIExploit, Third Party Advisory

Published

Mar 13, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-1000063Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2018-1000064Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2018-1000065Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2018-1000066Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2018-1000067An improper authorization vulnerability exists in Jenkins ve…5.3
• CVE-2018-1000068An improper input validation vulnerability exists in Jenkins…5.3
• CVE-2018-1000070Bitmessage PyBitmessage version v0.6.2 (and introduced in or…
• CVE-2018-1000071roundcube version 1.3.4 and earlier contains an Insecure Per…
• CVE-2018-1000072iRedMail version prior to commit f04b8ef contains a Insecure…
• CVE-2018-1000073RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.…
• CVE-2018-1000074RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.…
• CVE-2018-1000075RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.…